fix(slack): snapshot installations before choosing the member setup app

Author: waleedlatif1

apps/sim/lib/credential-groups/slack-managed-users.test.ts

@@ -94,6 +94,7 @@ describe('Slack managed-user authorization', () => {
   it('stores exact organization ownership in the encrypted setup attempt and rejects ambiguous ownership', async () => {
     dbChainMockFns.limit
       .mockResolvedValueOnce([{ id: 'group-1', updatedAt: new Date(1), options: [] }])
+      .mockResolvedValueOnce([])
       .mockResolvedValueOnce([
         {
           app: {
@@ -148,6 +149,7 @@ describe('Slack managed-user authorization', () => {
       shared.flag.mockImplementation(async (_flag, context) => context?.orgId === 'org-1')
       dbChainMockFns.limit
         .mockResolvedValueOnce([{ id: 'group-1', updatedAt: new Date(1), options: [] }])
+        .mockResolvedValueOnce([])
         .mockResolvedValueOnce([
           {
             app: {
@@ -272,6 +274,7 @@ describe('Slack managed-user authorization', () => {
       }
       dbChainMockFns.limit
         .mockResolvedValueOnce([group])
+        .mockResolvedValueOnce([])
         .mockResolvedValueOnce([{ app, teamId: 'T123' }])
 
       const created = await createSlackManagedUsersAttempt({

apps/sim/lib/credential-groups/slack-managed-users.ts

@@ -633,6 +633,11 @@ export async function createSlackManagedUsersAttempt(params: {
         'Select the organization’s Slack app. Configure its credentials in Slack app setup.',
         'invalid_response'
       )
+    /**
+     * Read before choosing the app: an install committed earlier is visible to that choice, and
+     * one committed later changes this snapshot, which completion re-checks under the lock.
+     */
+    installationsRevision = await organizationInstallationsRevision(db, scope.organizationId)
     const app = params.appId
       ? await resolveInstalledOrganizationSlackApp(
           scope.organizationId,
@@ -683,7 +688,6 @@ export async function createSlackManagedUsersAttempt(params: {
     }
     if (searchApproval.approved)
       requiredScopes = [...new Set([...requiredScopes, ...SLACK_SEARCH_USER_SCOPES])]
-    installationsRevision = await organizationInstallationsRevision(db, scope.organizationId)
   } else {
     if (!params.slackBotCredentialId)
       throw new SlackManagedUsersError('Select a custom Slack bot.', 'invalid_response')